Privacy Policy

AchievoEDU PTY LTD ('AchievoEDU', 'we', 'us', 'our') is committed to protecting the privacy of all individuals who use our platform, including students, teachers, school administrators, and parents. This Privacy Policy explains how we collect, use, store, disclose, and protect personal information, having regard to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By accessing or using the AchievoEDU platform (available at app.achievoedu.com.au and via our iOS and Android mobile applications, with our public website at achievoedu.com.au), you agree to the practices described in this policy.

1. Who We Are

AchievoEDU PTY LTD is an Australian educational technology company that provides a student engagement and wellbeing platform to schools. Our platform is used by students (including minors), parents, teachers, and school administrators. Individual teachers can also try the platform through our free Teacher Trial (see Section 2.6).

For privacy-related questions, please contact our Privacy Officer at: privacy@achievoedu.com.au

2. What Information We Collect

2.1 Student Data

• Full name and year level
• Date of birth and gender (as recorded by the school)
• School enrolment identifier (provided by the school)
• House, roll class and class enrolments
• Behaviour records, points, badges, and awards
• Character competency progress
• Store purchase and redemption history
• Attendance records (where enabled by the school)
• Daily wellbeing check-in responses (where enabled by the school)
• Safety (bullying) reports the student submits, including what happened and who needs support (see Section 6)
• Messages and posts the student creates, such as Gratitude Wall messages and Student Voice suggestions, including posts made anonymously (see Section 6)
• Device identifiers for push notifications (mobile app)

2.2 Teacher and Staff Data

• Full name, email address, and staff identifier
• School and class assignments
• Platform activity logs (behaviours recorded, reports generated)
• Login timestamps and session data

2.3 Parent and Guardian Data

• Full name and email address
• Relationship to student
• Notification preferences

2.4 Administrator Data

• Full name, email, and role
• School configuration settings and audit logs

2.5 Technical Data

• IP address and browser/device type
• Usage analytics (pages visited, features used, session duration)
• Error logs and crash reports

2.6 Teacher Trial Data

Teachers can sign up for a free Teacher Trial without a school account. For a trial we collect:

• The teacher's name, email address, school name (if given) and password (stored as a secure hash)
• Class names, and the students the teacher adds to them, by first name only
• Points, rewards and classroom tool settings the teacher creates

Trial students do not have accounts and cannot log in. Teachers should enter first names only and no other identifying information about their students. Trial accounts that aren't used for 12 months are automatically deleted, along with all their data. A trial teacher can also ask us to delete their trial account and its data at any time by emailing privacy@achievoedu.com.au.

3. How We Use Personal Information

We use personal information solely for the following purposes:

• Delivering the AchievoEDU platform services to schools and their users
• Enabling schools to track, reward, and report on student behaviour and progress
• Sending notifications to students, parents, and staff as configured by the school
• Providing customer support and responding to queries
• Improving platform performance, features, and security
• Complying with legal obligations

We do not use student data for advertising, profiling for commercial purposes, or any purpose unrelated to the delivery of educational services.

4. Data Storage and Location

All AchievoEDU student records, our database, and backups are stored on Microsoft Azure data centres located in Australia, and stay within Australia. Transactional email (for example welcome, password-reset and weekly summary emails) is sent through Microsoft Azure Communication Services, with its data stored in Australia.

Overseas processing (cross-border disclosure, APP 8): one delivery service processes limited information outside Australia. Push notifications are sent through Google Firebase Cloud Messaging and Apple's Push Notification service (United States), which handle a device identifier and the notification's text. We use these providers only to deliver our own notifications on your behalf, never for their own purposes, and we take reasonable steps to ensure they handle the information consistently with the Australian Privacy Principles. We are also reducing the personal information contained in notification text.

Data is encrypted at rest using AES-256 encryption and in transit using TLS 1.2 or higher. Database backups are performed daily and retained for 30 days.

Journal entries that a student marks as private are visible only to that student and are not accessible to teachers, school administrators, or parents. Daily wellbeing check-in responses are stored securely and are accessible only to the school's designated pastoral care staff (see Section 6).

5. Who We Share Data With

AchievoEDU does not sell, rent, or trade personal information. We may share data only in the following limited circumstances:

• The school that enrolled the user — schools have full access to their own students' data
• Parents or guardians — limited to their own child's data, as configured by the school
• Microsoft Azure (Australia) — cloud infrastructure: hosting, database, storage and backups, subject to their Data Processing Agreement
• Microsoft Azure Communication Services (Australia) — transactional email delivery (recipient email address and email content)
• Google (Firebase Cloud Messaging) (United States) — push-notification delivery (device token and notification text)
• Apple (Push Notification service / APNs) (United States) — push-notification delivery to iOS devices (device token and notification text)
• Stripe (United States) — subscription payments; processes the school's billing contact and payment details (no student data)
• EmailJS — website contact-form email delivery only (no student data is transmitted)
• Calendly (United States) — demo-booking scheduling on our public website only; processes the name, email and scheduling details you enter to book a demo (no student data)
• Law enforcement or regulatory bodies — where required by Australian law

All third-party processors are required to maintain confidentiality and comply with Australian privacy law.

6. Student Data — Special Protections

AchievoEDU recognises that student data requires heightened protection. We apply the following additional safeguards:

• Student accounts may only be created by authorised school administrators — students cannot self-register. In the Teacher Trial, teachers add students by first name only and no student account is created
• Student data is never shared with other schools or third parties for commercial purposes
• Student data is deleted within 30 days of a school's subscription ending, unless a longer retention is required by law
• Wellbeing check-in responses are visible only to designated pastoral care staff, not to other students
• Safety (bullying) reports are visible only to the school's administrators. The reporting student's identity is recorded so the school can follow up, and is never shown to other students. Where the school sets up report alerts, the alert email to the school's chosen contacts includes the report details but not the reporting student's name
• When the school allows anonymous posts on the Gratitude Wall or Student Voice, an anonymous post hides the author's name from other students, staff and administrators. The author is still recorded, so the student can see their own posts and to prevent misuse
• Parents may request a copy of their child's data at any time through their school administrator

7. Data Retention

We retain personal data only for as long as necessary to deliver our services or as required by law:

• Active school accounts — data retained for the duration of the subscription plus 30 days
• Closed school accounts — data deleted within 30 days of account closure
• System logs — retained only as long as necessary for security and debugging purposes
• Backup snapshots — overwritten on a rolling 30-day cycle, so backup copies are gone within 30 days

Schools may request early deletion of their data by contacting privacy@achievoedu.com.au. Schools may also export all data at any time from the admin portal.

8. Access, Correction, and Complaints

Under the Australian Privacy Principles, individuals have the right to:

• Request access to personal information we hold about them
• Request correction of inaccurate, incomplete, or outdated information
• Request deletion of their data (subject to legal retention requirements)
• Lodge a complaint about how we handle personal information

Students and parents should direct requests through their school administrator. Staff and administrators may contact us directly at privacy@achievoedu.com.au. We acknowledge privacy enquiries within 2 business days and fulfil access, correction, and deletion requests within 10 business days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

9. Cookies and Analytics

Our public website (achievoedu.com.au) uses Google Analytics 4 to understand how visitors find and use the site — for example, which pages are viewed and general, city-level location — so we can improve it. Google Analytics sets first-party cookies and processes this data on our behalf; IP addresses are handled in a de-identified way, and we do not enable advertising personalisation or share personal information for advertising. Our demo-booking page also embeds a Calendly scheduling widget, which may set its own cookies and processes the name, email and scheduling details you enter to book a demo (Calendly is a United States provider). The AchievoEDU platform itself uses session cookies for authentication only and does not use third-party advertising cookies.

10. Security

We implement industry-standard security measures including:

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for data at rest
• Role-based access control — users only see data relevant to their role
• Ongoing internal security reviews
• Automated vulnerability scanning of dependencies
• Prompt notification to affected schools in the event of an eligible data breach

11. Changes to This Policy

We may update this Privacy Policy from time to time. Schools will be notified of material changes by email at least 30 days before they take effect. The current version is always available at www.achievoedu.com.au/privacy.

12. Contact Us

For privacy-related enquiries, please contact:

Privacy Officer — AchievoEDU PTY LTD
Email: privacy@achievoedu.com.au
Web: www.achievoedu.com.au/privacy
Australia